The TOAD Trap: Why Scammers are Trading Malicious Links for VoIP Phone Numbers

This intelligence brief details a shift in phishing tactics toward Telephone-Oriented Attack Delivery (TOAD), where attackers embed phone numbers (frequently VoIP) in email lures to drive real-time social-engineering calls. The report notes wide use of VoIP (≈55% of detected campaigns), provider abuse (e.g., Sinch), rapid phone-number recycling to evade reputation filters, examples of reused numbers across different brand impersonations, and the use of varied attachment formats to bypass file-based detection — recommending defenders cluster phone numbers to map related campaigns.